Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-208:04 advisory.

    * docker: Ambient capability usage in containers (CVE-2016-8867)
      * docker: Security regression of CVE-2019-5736 due to inclusion of vulnerable runc (CVE-2020-14298)
      * docker: Security regression of CVE-2016-9962 due to inclusion of vulnerable runc (CVE-2020-14300)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03545-1 advisory.

    Note this update contains a already fixed references mostly.

    - Remove git-core recommends on SLE to avoid pulling it in unnecessary. (bsc#1250508)

      This feature is mostly intended for developers ('docker build git://') so       most users already have the dependency installed, and the error when git is       missing is fairly straightforward (so they can easily figure out what they       need to install).

    - Include historical changelog data from before the docker-stable fork. The       initial changelog entry did technically provide all the necessary       information, but our CVE tracking tools do not understand how the package is       forked and so it seems that this package does not include fixes for ~12 years       of updates. So, include a copy of the original package's changelog up until       the fork point. bsc#1250596

    - Update to docker-buildx v0.25.0. Upstream changelog:
      <https://github.com/docker/buildx/releases/tag/v0.25.0>

    - Update to Go 1.23 for building now that upstream has switched their 23.0.x       LTSS to use Go 1.23.

    - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as       Docker does not have permission to access the host zypper credentials in this       mode (and unprivileged users cannot disable the feature using       /etc/docker/suse-secrets-enable.) bsc#1240150

    - Initial docker-stable fork, forked from Docker 24.0.7-ce release       (packaged on 2024-02-14). The original changelog is included below for       historical reference.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03540-1 advisory.

    - Include historical changelog data from before the docker-stable fork. The       initial changelog entry did technically provide all the necessary       information, but our CVE tracking tools do not understand how the package is       forked and so it seems that this package does not include fixes for ~12 years       of updates. So, include a copy of the original package's changelog up until       the fork point. (bsc#1250596)

    - Remove git-core recommends on SLE. Most SLE systems have       installRecommends=yes by default and thus end up installing git with Docker.
      bsc#1250508

      This feature is mostly intended for developers ('docker build git://') so       most users already have the dependency installed, and the error when git is       missing is fairly straightforward (so they can easily figure out what they       need to install).

    - Backport <https://github.com/moby/moby/pull/48517>. bsc#1247362

    - Update to docker-buildx v0.25.0. Upstream changelog:
      <https://github.com/docker/buildx/releases/tag/v0.25.0>

    - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as       Docker does not have permission to access the host zypper credentials in this       mode (and unprivileged users cannot disable the feature using       /etc/docker/suse-secrets-enable.) bsc#1240150

    - Initial docker-stable fork, forked from Docker 24.0.7-ce release       (packaged on 2024-02-14). The original changelog is included below for       historical reference.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2653 advisory.

  - Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed     malicious images to bypass user permissions to access files within the container filesystem or mounted     volumes. (CVE-2016-8867)

  - The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory     included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via     RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container     host and other containers running on the same host. This issue only affects docker version     1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions     are not affected. (CVE-2020-14298)

  - The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7     Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version     of runc that was missing multiple bug and security fixes. One of the fixes regressed in that update was     the fix for CVE-2016-9962, that was previously corrected in the docker packages in Red Hat Enterprise     Linux 7 Extras via RHSA-2017:0116 (https://access.redhat.com/errata/RHSA-2017:0116). The CVE-2020-14300     was assigned to this security regression and it is specific to the docker packages produced by Red Hat.
    The original issue - CVE-2016-9962 - could possibly allow a process inside container to compromise a     process entering container namespace and execute arbitrary code outside of the container. This could lead     to compromise of the container host or other containers running on the same container host. This issue     only affects a single version of Docker, 1.13.1-108.git4ef4b30, shipped in Red Hat Enterprise Linux 7.
    Both earlier and later versions are not affected. (CVE-2020-14300)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2653 advisory.

    Docker is an open-source engine that automates the deployment of any application as a lightweight,     portable, self-sufficient container that runs virtually anywhere.

    Security Fix(es):

    * docker: Ambient capability usage in containers (CVE-2016-8867)

    * docker: Security regression of CVE-2019-5736 due to inclusion of vulnerable runc (CVE-2020-14298)

    * docker: Security regression of CVE-2016-9962 due to inclusion of vulnerable runc (CVE-2020-14300)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for containerd, docker, runc fixes the following issues :

Security issues fixed :

  - CVE-2016-8867: Fix ambient capability usage in     containers (bsc#1007249).

Bugfixes :

  - boo#1006368: Fixed broken docker/containerd installation     when installed by SuSE Studio in an appliance.

  - boo#1004490: Update docker to 1.12.2

  - boo#977394: Fix go version to 1.5.

  - boo#999582: Change the internal mountpoint name to not     use ':' as that character can be considered a special     character by other tools.

  - Update docker to 1.12.3

  - https://github.com/docker/docker/releases/tag/v1.12.3 This update changes the runc versioning scheme to prevent version downgrades     (boo#1009961).

ID	Name	Product	Family	Severity
294238	MiracleLinux 7 : docker-1.13.1-162.git64e9980.0.1.el7.AXS7 (AXSA:2020-208:04)	Nessus	Miracle Linux Local Security Checks	high
270307	SUSE SLES15 / openSUSE 15 Security Update : docker-stable (SUSE-SU-2025:03545-1)	Nessus	SuSE Local Security Checks	critical
270099	SUSE SLES12 Security Update : docker-stable (SUSE-SU-2025:03540-1)	Nessus	SuSE Local Security Checks	critical
208519	CentOS 7 : docker (RHSA-2020:2653)	Nessus	CentOS Local Security Checks	high
137755	RHEL 7 : docker (RHSA-2020:2653)	Nessus	Red Hat Local Security Checks	high
95554	openSUSE Security Update : containerd / docker / runc (openSUSE-2016-1400)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-8867

high

Tenable Plugins

high

critical

critical

high

high

high